Lucene search

WPScanCVE-2021-24593

HistoryAug 30, 2021 - 3:15 p.m.

CVE-2021-24593

2021-08-3015:15:07

CWE-79

WPScan

web.nvd.nist.gov

cve-2021-24593

business hours indicator

wordpress plugin

authenticated stored xss

nvd

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

24.8%

JSON

The Business Hours Indicator WordPress plugin before 2.3.5 does not sanitise or escape its 'Now closed message" setting when outputting it in the backend and frontend, leading to an Authenticated Stored Cross-Site Scripting issue

Affected configurations

Nvd

Vulners

Node

business_hours_indicator_projectbusiness_hours_indicatorRange<2.3.5wordpress

VendorProductVersionCPE
business_hours_indicator_projectbusiness_hours_indicator*cpe:2.3:a:business_hours_indicator_project:business_hours_indicator:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
business_hours_indicator_project	business_hours_indicator	*	cpe:2.3:a:business_hours_indicator_project:business_hours_indicator::::::wordpress::*

CNA Affected

[
  {
    "product": "Business Hours Indicator",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "2.3.5",
        "status": "affected",
        "version": "2.3.5",
        "versionType": "custom"
      }
    ]
  }
]

References

wpscan.com/vulnerability/309296d4-c397-4fc7-85fb-a28b5b5b6a8d

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

24.8%

JSON

Related for CVE-2021-24593